All of lore.kernel.org
 help / color / mirror / Atom feed
From: Zheng Hacker <hackerzheng666@gmail.com>
To: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: tvrtko.ursulin@linux.intel.com, security@kernel.org,
	alex000young@gmail.com, airlied@linux.ie,
	Greg KH <gregkh@linuxfoundation.org>,
	intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	dri-devel@lists.freedesktop.org, xmzyshypnc <1002992920@qq.com>,
	rodrigo.vivi@intel.com, intel-gvt-dev@lists.freedesktop.org,
	zhi.a.wang@intel.com
Subject: Re: [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry.
Date: Thu, 8 Sep 2022 17:09:40 +0800	[thread overview]
Message-ID: <CAJedcCxO_Rq0qMeLiHtY5+FuN1A1pDGsZd3gMtvUpm1xbAK3aA@mail.gmail.com> (raw)
In-Reply-To: <20220907030754.GU1089@zhen-hp.sh.intel.com>

Hi Zhenyu,

This issue has been open for a few days. Could you plz write a patch
for that :) I'm not familiar with the logical code here.

Regards,
Zheng Wang

Zhenyu Wang <zhenyuw@linux.intel.com> 于2022年9月7日周三 11:33写道:
>
> On 2022.09.06 19:36:56 +0800, Zheng Hacker wrote:
> > Hi Greg,
> >
> > Alex has explained how we figured out the patch. We did analyze the
> > code and found it possible to reach the vulnerability code. But we
> > have no physical device in hand to test the driver. So we'd like to
> > discuss with developers to see if the issue exists or not.
> >
> > Best regards,
> > Zheng Wang.
> >
> > Greg KH <gregkh@linuxfoundation.org> ???2022???9???5????????? 16:04?????????
> > >
> > > On Mon, Sep 05, 2022 at 03:46:09PM +0800, Zheng Hacker wrote:
> > > > I rewrote the letter. Hope it works.
> > > >
> > > > There is a double-free security bug in split_2MB_gtt_entry.
> > > >
> > > > Here is a calling chain :
> > > > ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry.
> > > > If intel_gvt_dma_map_guest_page failed, it will call
> > > > ppgtt_invalidate_spt, which will finally call ppgtt_free_spt and
> > > > kfree(spt). But the caller does not notice that, and it will call
> > > > ppgtt_free_spt again in error path.
> > > >
>
> It's a little mess in code so in theory it might be possible but
> intel_gvt_dma_map_guest_page won't fail in practise...
>
> > > > Fix this by returning the result of ppgtt_invalidate_spt to split_2MB_gtt_entry.
> > > >
>
> I don't see why changing ret value can fix this issue, as it doesn't change
> any behavior e.g caller of ppgtt_populate_spt to handle possible different error return.
>
> As current code looks assuming that ppgtt_invalidate_spt would free spt in good case,
> I think the real cleanup should split that assumption and handle free in error case properly.
>
> > > > Signed-off-by: Zheng Wang
>
> This misses proper email address.
>
> thanks
>
> > > >
> > > > ---
> > > >  drivers/gpu/drm/i915/gvt/gtt.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> > > > index ce0eb03709c3..9f14fded8c0c 100644
> > > > --- a/drivers/gpu/drm/i915/gvt/gtt.c
> > > > +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> > > > @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> > > >                 ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
> > > >                                                    PAGE_SIZE, &dma_addr);
> > > >                 if (ret) {
> > > > -                       ppgtt_invalidate_spt(spt);
> > > > +                       ret = ppgtt_invalidate_spt(spt);
> > > >                         return ret;
> > >
> > > But now you just lost the original error, shouldn't this succeed even if
> > > intel_gvt_dma_map_guest_page() failed?
> > >
> > > And how are you causing intel_gvt_dma_map_guest_page() to fail in a real
> > > system?
> > >
> > > thanks,
> > >
> > > greg k-h

WARNING: multiple messages have this Message-ID (diff)
From: Zheng Hacker <hackerzheng666@gmail.com>
To: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Greg KH <gregkh@linuxfoundation.org>,
	alex000young@gmail.com, security@kernel.org,
	dri-devel@lists.freedesktop.org, tvrtko.ursulin@linux.intel.com,
	airlied@linux.ie, intel-gfx@lists.freedesktop.org,
	joonas.lahtinen@linux.intel.com, linux-kernel@vger.kernel.org,
	xmzyshypnc <1002992920@qq.com>,
	jani.nikula@linux.intel.com, daniel@ffwll.ch,
	rodrigo.vivi@intel.com, intel-gvt-dev@lists.freedesktop.org,
	zhi.a.wang@intel.com
Subject: Re: [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry.
Date: Thu, 8 Sep 2022 17:09:40 +0800	[thread overview]
Message-ID: <CAJedcCxO_Rq0qMeLiHtY5+FuN1A1pDGsZd3gMtvUpm1xbAK3aA@mail.gmail.com> (raw)
In-Reply-To: <20220907030754.GU1089@zhen-hp.sh.intel.com>

Hi Zhenyu,

This issue has been open for a few days. Could you plz write a patch
for that :) I'm not familiar with the logical code here.

Regards,
Zheng Wang

Zhenyu Wang <zhenyuw@linux.intel.com> 于2022年9月7日周三 11:33写道:
>
> On 2022.09.06 19:36:56 +0800, Zheng Hacker wrote:
> > Hi Greg,
> >
> > Alex has explained how we figured out the patch. We did analyze the
> > code and found it possible to reach the vulnerability code. But we
> > have no physical device in hand to test the driver. So we'd like to
> > discuss with developers to see if the issue exists or not.
> >
> > Best regards,
> > Zheng Wang.
> >
> > Greg KH <gregkh@linuxfoundation.org> ???2022???9???5????????? 16:04?????????
> > >
> > > On Mon, Sep 05, 2022 at 03:46:09PM +0800, Zheng Hacker wrote:
> > > > I rewrote the letter. Hope it works.
> > > >
> > > > There is a double-free security bug in split_2MB_gtt_entry.
> > > >
> > > > Here is a calling chain :
> > > > ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry.
> > > > If intel_gvt_dma_map_guest_page failed, it will call
> > > > ppgtt_invalidate_spt, which will finally call ppgtt_free_spt and
> > > > kfree(spt). But the caller does not notice that, and it will call
> > > > ppgtt_free_spt again in error path.
> > > >
>
> It's a little mess in code so in theory it might be possible but
> intel_gvt_dma_map_guest_page won't fail in practise...
>
> > > > Fix this by returning the result of ppgtt_invalidate_spt to split_2MB_gtt_entry.
> > > >
>
> I don't see why changing ret value can fix this issue, as it doesn't change
> any behavior e.g caller of ppgtt_populate_spt to handle possible different error return.
>
> As current code looks assuming that ppgtt_invalidate_spt would free spt in good case,
> I think the real cleanup should split that assumption and handle free in error case properly.
>
> > > > Signed-off-by: Zheng Wang
>
> This misses proper email address.
>
> thanks
>
> > > >
> > > > ---
> > > >  drivers/gpu/drm/i915/gvt/gtt.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> > > > index ce0eb03709c3..9f14fded8c0c 100644
> > > > --- a/drivers/gpu/drm/i915/gvt/gtt.c
> > > > +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> > > > @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> > > >                 ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
> > > >                                                    PAGE_SIZE, &dma_addr);
> > > >                 if (ret) {
> > > > -                       ppgtt_invalidate_spt(spt);
> > > > +                       ret = ppgtt_invalidate_spt(spt);
> > > >                         return ret;
> > >
> > > But now you just lost the original error, shouldn't this succeed even if
> > > intel_gvt_dma_map_guest_page() failed?
> > >
> > > And how are you causing intel_gvt_dma_map_guest_page() to fail in a real
> > > system?
> > >
> > > thanks,
> > >
> > > greg k-h

WARNING: multiple messages have this Message-ID (diff)
From: Zheng Hacker <hackerzheng666@gmail.com>
To: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: security@kernel.org, alex000young@gmail.com, airlied@linux.ie,
	Greg KH <gregkh@linuxfoundation.org>,
	intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	dri-devel@lists.freedesktop.org, xmzyshypnc <1002992920@qq.com>,
	daniel@ffwll.ch, rodrigo.vivi@intel.com,
	intel-gvt-dev@lists.freedesktop.org
Subject: Re: [Intel-gfx] [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry.
Date: Thu, 8 Sep 2022 17:09:40 +0800	[thread overview]
Message-ID: <CAJedcCxO_Rq0qMeLiHtY5+FuN1A1pDGsZd3gMtvUpm1xbAK3aA@mail.gmail.com> (raw)
In-Reply-To: <20220907030754.GU1089@zhen-hp.sh.intel.com>

Hi Zhenyu,

This issue has been open for a few days. Could you plz write a patch
for that :) I'm not familiar with the logical code here.

Regards,
Zheng Wang

Zhenyu Wang <zhenyuw@linux.intel.com> 于2022年9月7日周三 11:33写道:
>
> On 2022.09.06 19:36:56 +0800, Zheng Hacker wrote:
> > Hi Greg,
> >
> > Alex has explained how we figured out the patch. We did analyze the
> > code and found it possible to reach the vulnerability code. But we
> > have no physical device in hand to test the driver. So we'd like to
> > discuss with developers to see if the issue exists or not.
> >
> > Best regards,
> > Zheng Wang.
> >
> > Greg KH <gregkh@linuxfoundation.org> ???2022???9???5????????? 16:04?????????
> > >
> > > On Mon, Sep 05, 2022 at 03:46:09PM +0800, Zheng Hacker wrote:
> > > > I rewrote the letter. Hope it works.
> > > >
> > > > There is a double-free security bug in split_2MB_gtt_entry.
> > > >
> > > > Here is a calling chain :
> > > > ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry.
> > > > If intel_gvt_dma_map_guest_page failed, it will call
> > > > ppgtt_invalidate_spt, which will finally call ppgtt_free_spt and
> > > > kfree(spt). But the caller does not notice that, and it will call
> > > > ppgtt_free_spt again in error path.
> > > >
>
> It's a little mess in code so in theory it might be possible but
> intel_gvt_dma_map_guest_page won't fail in practise...
>
> > > > Fix this by returning the result of ppgtt_invalidate_spt to split_2MB_gtt_entry.
> > > >
>
> I don't see why changing ret value can fix this issue, as it doesn't change
> any behavior e.g caller of ppgtt_populate_spt to handle possible different error return.
>
> As current code looks assuming that ppgtt_invalidate_spt would free spt in good case,
> I think the real cleanup should split that assumption and handle free in error case properly.
>
> > > > Signed-off-by: Zheng Wang
>
> This misses proper email address.
>
> thanks
>
> > > >
> > > > ---
> > > >  drivers/gpu/drm/i915/gvt/gtt.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> > > > index ce0eb03709c3..9f14fded8c0c 100644
> > > > --- a/drivers/gpu/drm/i915/gvt/gtt.c
> > > > +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> > > > @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> > > >                 ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
> > > >                                                    PAGE_SIZE, &dma_addr);
> > > >                 if (ret) {
> > > > -                       ppgtt_invalidate_spt(spt);
> > > > +                       ret = ppgtt_invalidate_spt(spt);
> > > >                         return ret;
> > >
> > > But now you just lost the original error, shouldn't this succeed even if
> > > intel_gvt_dma_map_guest_page() failed?
> > >
> > > And how are you causing intel_gvt_dma_map_guest_page() to fail in a real
> > > system?
> > >
> > > thanks,
> > >
> > > greg k-h

  parent reply	other threads:[~2022-09-08  9:09 UTC|newest]

Thread overview: 68+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <tencent_E1BBF05904DFB73C478DCD592740AAE0780A@qq.com>
2022-09-05  4:47 ` [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Hacker
2022-09-05  4:47   ` [Intel-gfx] " Zheng Hacker
2022-09-05  6:11   ` Zheng Hacker
2022-09-05  6:11     ` [Intel-gfx] " Zheng Hacker
2022-09-05  7:35   ` Zheng Hacker
2022-09-05  7:35     ` [Intel-gfx] " Zheng Hacker
2022-09-05  7:35     ` Zheng Hacker
2022-09-05  7:46     ` Zheng Hacker
2022-09-05  7:46       ` [Intel-gfx] " Zheng Hacker
2022-09-05  7:46       ` Zheng Hacker
2022-09-05  8:04       ` Greg KH
2022-09-05  8:04         ` [Intel-gfx] " Greg KH
2022-09-05  8:04         ` Greg KH
2022-09-05  8:53         ` Alex Young
2022-09-05  8:53           ` Alex Young
2022-09-06 11:36         ` Zheng Hacker
2022-09-06 11:36           ` [Intel-gfx] " Zheng Hacker
2022-09-06 11:36           ` Zheng Hacker
2022-09-07  3:07           ` Zhenyu Wang
2022-09-07  3:07             ` [Intel-gfx] " Zhenyu Wang
2022-09-07  3:07             ` Zhenyu Wang
2022-09-07  6:47             ` Zheng Hacker
2022-09-07  6:47               ` [Intel-gfx] " Zheng Hacker
2022-09-07  6:47               ` Zheng Hacker
2022-09-08  9:09             ` Zheng Hacker [this message]
2022-09-08  9:09               ` [Intel-gfx] " Zheng Hacker
2022-09-08  9:09               ` Zheng Hacker
2022-09-08  9:19               ` Greg KH
2022-09-08  9:19                 ` [Intel-gfx] " Greg KH
2022-09-08  9:19                 ` Greg KH
2022-09-08 11:59                 ` Zheng Hacker
2022-09-08 11:59                   ` [Intel-gfx] " Zheng Hacker
2022-09-16  6:39                   ` Zheng Hacker
2022-09-16  6:39                     ` [Intel-gfx] " Zheng Hacker
2022-09-16  6:39                     ` Zheng Hacker
2022-09-16  6:40                     ` Zheng Hacker
2022-09-16  6:40                       ` [Intel-gfx] " Zheng Hacker
2022-09-16  6:40                       ` Zheng Hacker
2022-09-16  8:25                     ` Greg KH
2022-09-16  8:25                       ` [Intel-gfx] " Greg KH
2022-09-16  8:25                       ` Greg KH
2022-09-16 15:21                       ` Zheng Hacker
2022-09-16 15:21                         ` [Intel-gfx] " Zheng Hacker
2022-09-16 15:21                         ` Zheng Hacker
2022-09-16 15:54                       ` Zheng Hacker
2022-09-16 15:54                         ` [Intel-gfx] " Zheng Hacker
2022-09-16 15:54                         ` Zheng Hacker
2022-09-17  9:08                         ` Greg KH
2022-09-17  9:08                           ` [Intel-gfx] " Greg KH
2022-09-17  9:08                           ` Greg KH
2022-09-17  9:10                           ` Zheng Hacker
2022-09-17  9:10                             ` [Intel-gfx] " Zheng Hacker
2022-09-18 17:08                           ` =?gb18030?B?s68=?=
2022-09-18 17:08                             ` [Intel-gfx] " =?gb18030?B?s68=?=
2022-09-18 17:17                           ` Zheng Hacker
2022-09-18 17:17                             ` [Intel-gfx] " Zheng Hacker
2022-09-18 17:17                             ` Zheng Hacker
2022-09-19 20:16   ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for " Patchwork
2022-09-06 12:58 ` Patchwork
2022-09-06 14:22   ` Zheng Hacker
2022-09-06 14:29   ` Zheng Hacker
2022-09-19 20:20 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for ✗ Fi.CI.BUILD: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry. (rev3) Patchwork
2022-09-18 19:24 [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Wang
2022-09-19  9:30 ` Jani Nikula
2022-09-19  9:55   ` Zheng Hacker
2022-09-19  9:55     ` Zheng Hacker
2022-09-21  9:13   ` Zheng Hacker
2022-09-21  9:13     ` Zheng Hacker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAJedcCxO_Rq0qMeLiHtY5+FuN1A1pDGsZd3gMtvUpm1xbAK3aA@mail.gmail.com \
    --to=hackerzheng666@gmail.com \
    --cc=1002992920@qq.com \
    --cc=airlied@linux.ie \
    --cc=alex000young@gmail.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=intel-gvt-dev@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rodrigo.vivi@intel.com \
    --cc=security@kernel.org \
    --cc=tvrtko.ursulin@linux.intel.com \
    --cc=zhenyuw@linux.intel.com \
    --cc=zhi.a.wang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.